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In recent paper 0, Kye et al. claim that using the 
blind polarization, their new quantum key distribution 
scheme can be secure even when a key is embedded in 
a not-so-weak coherent-state pulse. Here we show an 
eavesdropping scheme, by which the eavesdropper can 
achieve the full information of the key with a probability 
of unity and will not be discovered by the the legitimate 
users, even in the case that they have the perfect single- 
photon source and the losclcss channel. 

There are two protocols in Ref. |j| . Consider their first 
protocol: 
Protocol 1: 

(al) Alice(the sender) prepares a linear polarized qubit 
in its initial state \ip)o = |0), where |0) and |1) represent 
two orthogonal polarizations of the qubit, and chooses a 
random angle 8. 

(o2) Alice rotates the polarization of the qubit by 0, 
to bring the state of the qubit to \yj)i = U y (8)\ip) — 
cos 8 1 0) — sin 8 1 1), and then sends the qubit to Bob (the 
receiver) . 

(a3) Bob chooses another random angle and rotates 
the polarization of the received qubit by d>; | V)a — 
U y (<t>)\ip)i = cos(6> + 0)|O) -sin(0 + 0)|l), Bob sends the 
qubit back to Alice. 

(o4) Alice rotates the polarization angle of the qubit by 
—8 and then encodes the message by further rotating the 
polarization angle of ±j\ \i/j}3 = U y (±j ) x U y (—8)\ip)2, 
Alice send the qubit to Bob. (Alice and Bob have prede- 
termined that +j is say, "0" and — ? is "1". 

(a5) Bob measure the polarization after rotating the 
polarization by ~4>; |^) 4 = U y (-cf))\ip) 3 = U y (±j )\ip)o, 
U y (+j) and Uy(—j) are orthogonal to each other, which 
enables Bob to read the keys precisely. 

Our attacking scheme works as following: 

(al') After step (a2) in the above protocol, Eve inter- 
cepts all qubits from Alice and stores them. (We denote 
these qubits as "set 1"). Meanwhile, sends her own qubits 
with each of them being randomly in state \p) , p is either 
or 1. (We denote these qubits as "set 2"). Eve can 
remember the state of each qubits sent from her. 

(a2') After step (a3), Eve intercepts all qubits from 
Bob and stores them. Note that all these qubits are from 
set 2 originally. Then, Eve sends set 1 to Alice. 



(a3') After step (a4), Eve intercepts all qubits from 
Alice and measures each of them in ±^ basis. Reading 
the measurement outcome, Eve knows Alice's choice of 
j or — ■?) i.e., the bit values of each pulse from Alice, 
k = 0, 1 for f or — respectively. 

(a4') According to the measurement result of each 
qubits from Alice, Eve takes appropriate unitary rota- 
tions to those qubits stored by her in step (a2') and sends 
them to Bob. Explicitly, to any qubit, if its original value 
p = 0, Eve rotates the polarization by (— l) fe f and sends 
it to Bob; if p = 1, she first flips its polarization between 
|0) and |1) and then rotates the polarization by (— l) fe f 
and sends it to Bob. Bob will just implement step (a5) 
and in such a way, Bob will have no error after the pro- 
tocol. 

Knowing that protocol 1 suffers from the above types 
of impersonation attack , they have proposed protocol 
2 and claimed that the modified protocol will be secure 
under such attacks. We now show that Eve can access the 
full information of the key from their modified protocol 
by almost the same impersonation attack. Let us first 
recall their modified protocol. 
Protocol 2: 

(61) Alice sends two single-photon pulses of the polar- 
ization angles 8\ and 82 to Bob. 

(b2) Bob rotates the polarization angles of the pulses 
by q> + (-l) s f and 4> + (-l) sel f ,where the shuffling 
parameter s 6 {0,1} is randonmly chosen by Bob and 
© denotes addition modulo 2. And then Bob sends the 
pulses back to Alice. 

(b3) Receiving the two pulses of their polarization an- 
gles 6>i+0+(-l) s f and 6> 2 + 0+(-l) sel f , Alice rotates 
the polarization angles of the pulses by —6\ + (— l) k j 
and —82 + (— l) fe f respectively, where k 6 {0,1} is the 
key value. She blocks one of the qubits and sends the 
other to Bob. The paper [l| introduces the blocking fac- 
tor b = 0, 1 to denote the case to let the first or the second 
pulse go. 

(64) When the qubit travels to Bob, he rotates the 
polarization angles of the pulses by —<f> and measures 
the polarization. He obtains the measurement outcome 
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s © k © 6 as the prekey bit value. 



(65) Alice publicly announces her blocking factor b. 
And depending on b and the shuffling parameter s, Bob 
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can decode the original key bit by k — s © 6 © I. 
Our attacking scheme is now the following: 
(61') After step (61), Eve intercepts and stores both 
pulses from Alice. (We denote these pulses as "set El"). 
Eve also sends two pulses to Bob. These two pulses are 
originally produced by Eve with random polarization an- 
gles of 9i, 62 ' ■ Eve remembers the polarization angle of 
each pulses. 

(62') After step (62) in protocol 2, Eve intercepts both 
pulses from Bob, rotates each of them by angle —61', —62 
and stores them. (We denote these pulses as "set E2"). 
Eve chooses her shuffling parameter s' — and ro- 
tates the two pulses in set El by angle (— l) s ? and 

(— l) s ® 1 f respectively. Eve sends the rotated pulses 
in set El to Alice. 

(63') After step (63), Eve intercepts and measures the 
pulse sent out by Alice in |0, basis. By reading mea- 
surement outcome, she knows the value I s k = s' ®k®b = 
k © 6 since the value s' is set by herself. (In our attack- 
ing scheme, s' = 0). Then she rotates the first pulse of 
set E2 with the angle of (-l) feeb f , sends it to Bob and 
discards the second pulse in set E2. (Remark: Although 
Eve knows neither 6 nor k, she knows the value of /c © 6 
and she can do the unitary rotation dependent on k © 6). 

When Alice announces the value of 6 i.e., which pulse 
she has blocked, Eve can get the value of k since she has 
already known the value of k © 6 and k = b © (k © 6). On 
the other hand, with the operation in step (63'), Bob's 



result about k— value will be identical to Alice's. Alice 
and Bob can not discover the eavesdropping. When Bob 
receives the pulse after step (63'), he makes the measure- 
ment like step (65) and will get the value l sk = s©(fc©6). 
Although the 6' value chosen by Eve may be different 
from the 6 value chosen by Alice, it does not cause any 
channel noise since Eve's actions in our attacking scheme 
will not affect Bob's measurement outcome for the value 
I, which is I = s © k © 6. 

Although it is known protocol 1 is probably insecure 
under impersonation attack , it has been assumed that 
protocol 2 is secure prior to our comment. We have for 
the first time shown the Protocol is totally insecure un- 
der our attack. Our eavesdropping method works even in 
the case that Alice has a perfect single-photon source and 
a transparent, noiseless channel. The protocols of blind 
polarization bases are insecure in their present forms Q . 
Moreover, in our present scheme, the quantum memories 
which are not practical in nowadays technology are not 
necessary, a long enough delay of the photon will be suffi- 
cient. Therefore, our attacking scheme only need existing 
technology. 
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